Using "Keychain Access" as a Password Manager

Hello All,
While searching for a secure, trustworthy password manager I started wondering why I couldn't just use Keychain Access built into the Mac OS.
I've tried others and they're all nice in their own way but why not use what's already there?
Any suggestions, concerns or gotchas are welcomed.
Thanks in advance for your time.
IAV

You can also change the security settings on your keychain and/or create additional keychains. So you might have one keychain with especially secure settings for certain items and another with less secure settings for others. Moreover, you can adjust some settings for each item within a keychain, as well.
Or you can do what I do which is set up several keychains and then render the whole system entirely pointless by saving the passwords in your original keychain because you are terrified you'll forget them otherwise... (I don't actually know why I set them up this way...)
My login password is not my keychain password and my keychain locks after a minute, I require a password to wake from sleep/screensaver (though this does not always work properly) and sensitive items require re-entry of the keychain password anyway. So you can set things up so your keychain is more secure if you want to, at the price of some increased inconvenience.
- cfr

Similar Messages

Keychain Access to recover password: "Access to this item is restricted."

I need to recover my network password, which I saved in my keychain, but can't figure out how to get it using keychain access. I've tried to get keychain access to reveal other passwords which I do know, but I can't get it to show them either. Here's what I tried to do:
Opened Keychain Access, found the network name, and double clicked on it. A window describes its attributes popped up, but the password field was blank. Clicking on the "Show password" box brought a window saying "Access to this item is restricted." I tried to retrieve other passwords in the keychain today using the same method with the same results.
I'm running Snow Lion, version 10.6.8.

OK, I played around with keychain access for a while, but finally hit on it. For the benefit of others with the same problem, here's what worked:
There are two sections on the left sidebar, Keychains and Category. I'd chosen "Passwords" in the Category section, and eventually, in poking just about everything in that window, I clicked on an arrow which expanded the Keychains section. I kept playing until I clicked on System in the Keychains section. That brought up all of my past networks. I double-clicked on my current network's name and once again clicked on the "show password" box. This time I was asked for my admin password, hit enter, and vois-la! there it was.
The only thing that had happened in the meantime was that I ran Keychain First Aid's verify and repair (found in Keychain Acces's File menu). I have no idea whether this is what changed things, or if it was just expanding the Keychains section, but now I can view any of my passwords in the Paswords choice in the Category section.
Who knows if this will help anyone, but I'll go to some of the other recent threads and post a link to this thread in case it can.

Adding Keychain issue using Keychain Access - 10.3.9/eMac

I recently crashed and had to erase my 10.3.9 volume.
I'm trying to add a Keychain in a new system I installed, from a 10.3.9 library that I had backed up on a DVD, using Keychain Access. When I navigate to the Keychain folder on the DVD in the "add Keychain" dialog box, the Keychain in the folder is greyed out. The icon for that file on the DVD looks different too...it's a landscape orientation rectangle that says "exec" on it. The current Keychain has a generic document icon.
Thanks for any help
pauly B ;D
eMac Mac OS X (10.3.9) 700 MHz / 384 MB / 40gig / CDR internal

Hi
Did you export your key chain when you had the old system, or just backed it up?
I haven't tried this but what if you tried to copy the entire backed up copy of keychain over to its natural location on the new disk. It is owned by system, so you will be asked for password confirmation, but i think it is possible to do it in this rough way than through adding to the existing key chain (which it doesn't want to do)
And you will need to remove the existing one first as it may resist being overwritten.
This is speculative, but if you are brave it may successful.
regards roam

Using Keychain Access for applications other than Safari

I am trying to decide what browser I want to use. There are several things to take into consideration - bookmarks kept in sync between the browers and passwords. So far I have stayed with Safari because it works with Keychain. I tried to open Keychain and add Firefox to a web form password but it doesnt appear to work. As for the bookmark issue, I downloaded "Bookdog" and it looks nice - the latest version is supposed to sync the bookmarks between the two browsers but I dont see a setting or option for that (emailed for support on that issue).
So, is there a way I can use Keychain for all of my browsers?

The following blueprint (http://www.sun.com/blueprints/0406/819-6320.pdf) describes what you want, but its not wise to put user-applications on well known ports. It wouldn't be the first time that an application crashes when a networkscanner is hammering on well known ports to find known problems. Also most of the time people are trying to bind there application on a well known port to bypass firewalls for example. So if you're going to do this, then please configure IPF for example to limit the amount of IPs that can access that port.

My keychain access file for passwords has wiped itself

I have a serious problem. I have gone to open the Password file i have in my keychain access under secure notes to find that the file is empty. No prob I thought... use time machine to get the info.... what is happening is that everytime i use time machine i find the file STILL empty and the date modified as todays date.......
every single password, code number, access code, pin ......evrey single piece of info i hae on everything from tax to bank to you name it, is in that file and without it i'm *********....
what i dont understand is why is time machine defaulting back to today and an empty file...surely the idea of time machine was to enable you to go back and back up any file folder etc that had destroyed corrupted or otherwise disappeared...
please help or I'm in serious trouble.....

Hey!
I had this problem, too!...
To copy the music back to your HD try "iPod -> Folder" <http://www.versiontracker.com/dyn/moreinfo/win/35148>.
But I think that you must already have the music on your PC...
After you have copied the music back to your HD, you have to restore the iPod with Apples iPod Updater <http://www.apple.com/ipod/download/>. After that, your iPod should work better than before!
I hope and think that should help!

Do any versions of FF support the use of Lenovo's ThinkVantage Password Manager s/w and fingerprint scanner?

Lenovo Edge 15" laptop running Windows 7 (64 bit) and using Thinkvantage Password Manager Ver 3.20.0330 and TouchStrip Fingerprint Sensor (UPEK).
The password manager is to set to restrict logins to websites to fingerprint but when logging into websites I am not given the option to use the fingerprint reader -(the login info stored in the P/W manager is entered and login takes place). I have seen elsewhere that FF 3.6 has problems supporting this combination and wonder if any earlier versions of FF would be suitable or if FF 4 is likely to support it.
Any help would be appreciated

Kent1968
I would recommend, if you have it set, to go to a restore point before you uninstalled the password manager version that did not give you a problem and not use the new version until this bug is resolved.
If the fingerprint light is not showing up, then it is probably not limited to you and I hope Lenovo checks it out.
Too bad the newer version seems to load slowly - I will check it out as well.
jEdgar

Using Keychain Access - enable ocsp protocol

I would like to enable OCSP.
In keychain Access -> preferences -> certificaes I can enable the CRL or OCSP functionality.
The options available are:
- Off: No revocation checking will be performed.
- Best Attempt: The certificate passes unless an indication of a bad certificate is
returned from the server.
- Require if Cert Indicates: If the URL to the revocation server is provided in the
certificate, this setting requires a successful connection to a revocation server and no
indication of a bad certificate.
- Require for All Certs: This setting requires successful validation of all certificates. It is
most useful in a tightly controlled environment that guarantees the presence of a
CRL server or OCSP responder.
- Priority: Determines which method (OCSP or CRL) is attempted first. If the first
method chosen returns a successful validation, the second method is not attempted.
The problem is that the "Require if Cert Indicates" and "Require for All Certs" options are disabled and I do not know how to enable them.
Howto can I enable this options on keychain access?
Regards
Giovanni.

In tiger OSX, the Require if Cert Indicates and Require for All Certs options in keychain Acces are available.
But I have not found how enable this options in keychain Access of Leopard 10.5.6.
Giovanni

Please Help With Keychain Access and Safari Passwords!

Hello,
I would like to take advantage of the capabilities that Keychain Access has to offer... I like how it can store passwords from websites. I have stored several website passwords in Keychain Access and currently have it set to where it asks for my keychain password when first opening Safari, and then it automatically fills in my passwords that are stored in Keychain Access in the corresponding websites. However, when I close Safari completely, the next time I open Safari it already has my passwords filled in, without asking for my keychain password. The only way I have found to make Safari ask for my keychain password every time it is opened is to select "lock all keychains" in Keychain Access. It is a pain to have to open Keychain Access every time I close Safari in order for Safari to ask for my keychain password again. Is there a more simple way to make Safari ask for my keychain password everytime I open Safari?

Hi, okwildthing. Welcome to the forums!
Try this:
Open Keychain Access and find "Safari Forms AutoFill" in the list. Double-click it and go to the "Access Control" tab. (You may need to enter your keychain password at this point.) Remove Safari from the "Always allow access by these applications" list. Press "Save Changes."
Does this get Safari to do what you want it to do?

Why is there an error when I try to use Keychain Access?

Hi,
I'm having this error when I reveal a password.
Any suggestions?

Try Keychain Access/First Aid. If that doesn't work, reset the Keychain.
Keychain Reset

Exporting auto-created SSL Certificate using Keychain Access

Whenever I try, I get:
"An error has occurred. Unable to export item.
You fail to provide the necessary administrator authorization."
Can it be done?

Got the same problem. It's a mystery to me as well. Happens both at my SL server 10.6.2 at home and at work. I have no idea what is wrong except that it might forget to prompt me. It also doesn't work if I unlock the certificate keychain first.

Keychain Access hangs on trying to reveal passwords

When I try to get a password stored in my login keychain, using Keychain Access, either by copying or revealing the password, Keychain Access hangs unrecoverably. I tried Keychain First Aid, which didn't find any problems. Strangely, Safari seems able to still pull passwords out of the keychain. Weird. Has anybody encountered this problem? Any solutions short of starting a whole new keychain?
Spin Control sample:
Call graph:
6001 Thread_4603
6001 0x14755
6001 0x3146
6001 NSApplicationMain
6001 -[NSApplication run]
6001 -[NSApplication sendEvent:]
6001 -[NSWindow sendEvent:]
6001 -[NSControl mouseDown:]
6001 -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:]
6001 -[NSCell trackMouse:inRect:ofView:untilMouseUp:]
6001 -[NSCell _sendActionFrom:]
6001 -[NSControl sendAction:to:]
6001 -[NSApplication sendAction:to:from:]
6001 0xe759
6001 0xe7f7
6001 0xe9e9
6001 SecKeychainItemCopyContent
6001 Security::KeychainCore::ItemImpl::getContent(unsigned long*, SecKeychainAttributeList*, unsigned long*, void**)
6001 Security::KeychainCore::ItemImpl::getContent(Security::CssmClient::DbAttributes *, Security::CssmDataContainer*)
6001 Security::CssmClient::SSDbUniqueRecordImpl::get(Security::CssmClient::DbAttribu tes*, Security::CssmDataContainer*, cssmaccesscredentials const*)
6001 Security::CssmClient::SSGroupImpl::decodeDataBlob(cssm_data const&, cssmaccesscredentials const*, Security::Allocator&, cssm_data&)
6001 Security::CssmClient::Decrypt::final(Security::CssmData&)
6001 CSSM_DecryptDataFinal
6001 cssm_DecryptDataFinal(unsigned long, unsigned long long, cssm_data*)
6001 Security::CSPFullPluginSession::CSPContext::final(Security::CssmData&, Security::Allocator&)
6001 SSCryptContext::outputSize(bool, unsigned long)
6001 Security::SecurityServer::ClientSession::decrypt(Security::Context const&, unsigned long, Security::CssmData const&, Security::CssmData&, Security::Allocator&)
6001 ucspclientdecrypt
6001 machmsgtrap
6001 machmsgtrap
Total number in stack (recursive counted multiple, when >=5):
Sort by top of stack, same collapsed (when >= 5):
machmsgtrap 6001
Message was edited by: Daniel Pritchard

Hi,
I had the same problem yesterday. Browsers could get the passwords for websites, but Transmit hung as soon as I selected a favorite and Keychain Access did the same (including no errors running First Aid) as soon as I tried to reveal any of my passwords. In my case I just needed to reboot and all was fine...
Björn

Trying to view WIFI password in Keychain Access and asking for administrator' name and password?

This is the first time this happen and I had never have this problem before when using Keychain Access.
I try using my current password but it doesn't accept.
I try using the Keychain First Aid and it didn't work either.
Note: I had change my login password a 2 weeks ago, but I try using the old password to and and didn't help either.
My OS 10.9 Maverick.
Any ideas what's happening here and how to fix this problem?

It's normal.

My Kaspersky Password manager and a whole list of things I use daily have been disabled. I want to go back to my older version of Mozilla. How do I do that.

I want to go back to the older version of Mozilla. The new version does not support alot of the programs that I used daily, like my Kaspersky Password Manager (which is essential), I can't remember all of my usernames and passwords. If I can't use this feature, then I don't want the new version. How do I go back to the older version? Otherwise, I'll be forced to use Internet Explorer.

Due to security vulnerabilities, rolling back to Firefox 4.0.1 is not recommended. Firefox 3.6.18 would be the safer choice.
Here's the process to roll back:
First, I recommend backing up your Firefox settings in case something goes wrong. See [https://support.mozilla.com/en-US/kb/Backing+up+your+information Backing up your information]. (You can copy your entire Firefox profile folder somewhere outside of the Mozilla folder.)
Next, download and save Firefox 3.6 to your desktop for future installation. http://www.mozilla.com/firefox/all-older
Close Firefox 5.
You could install Firefox 3.6 over it (many have reported success) or you could uninstall Firefox first. If you uninstall, do not remove your personal data and settings, just the program.
Unless you have installed an incompatible add-on, Firefox 3.6 should pick up where you left off. If there are serious issues, please post back with details.
Note: I haven't actually tried this myself!

Two entries in Keychain Access with same name

I created a new keychain called "new-system" using Keychain Access. I set the password of this keychain to something besides my login password. Then I read something that I would not have to keep entering the keychain password to unlock the keychain if I changed the keychain's password to be my login password. I did this.
Now, when I invoke Keychain Access, I have two entries for "new-system" listed under keychains in the upper left. Each of these keychains takes a different password.
What is happening?

Hi V.K.
There are 2 files in ~/users/'myname'/library/keychains/
login.keychain and 'myname'.keychain
In Keychain Access however, I have 2 x login and 1 x 'myname'.
Thanks for your interest!
(I also have 2 x login in every other account including root... and I've used the Keychain Access "First-Aid" etc. etc. on them in every possible combination)
Message was edited by: vectr

Insecurity of Keychain Access: "secure" notes visible during authentication

Sorry if this has been discussed before, but I'm not keen on wading through 137 pages of discussions.
I recently discovered Keychain Access' ability to create "secure notes," and thought this would be a wonderful way to keep my serial numbers, bank accounts, and other sensitive information secure.
However, I just tried to actually decrypt this information for the first time, and was rather shocked. When you attempt to open a secure note, and select the "show note" checkbox that prompts the "Deny / Allow Once / Always Allow" dialog box, the dialog box contains the "secure" information from the note!
In my example, which you can see here (http://www.justinreese.com/media/images/secure_bbedit.png), the entire text of the note is included in the dialog, previous to any password authentication. Of course, because I'm reusing the login keychain, I understand that it's already been decrypted upon logging in; however, I was under the impression that using Keychain Access to store secure notes and other passwords offered a secondary level of protection, and that even if someone were able to compromise my system while I was logged in, at least that sensitive data would remain secure (the way a dedication application such as Wallet or Yojimbo would do it).
So... is this a bug, an oversight, or simply my own poor planning in using the login keychain to store secure information?
Thanks to all.
17" Powerbook G4/1.5Ghz Mac OS X (10.4.6) Stock + 1GB of RAM
17" Powerbook G4/1.5Ghz Mac OS X (10.4.6) Stock except 1.5GB of RAM

My suspicion is that when you created the note, in the "name" field, you used "paste" intending to paste "BBEdit 8 Registration". However, if the clipboard at the time had contained multiple lines, the "Name:" field would then contain the entire contents (Owner Name, Email Address, etc), although it might not be immediately apparent since the main "Keychain Access" window would only display the first line. However, when asking for authentication, the full "Name" is displayed. This scenario is easy enough to replicate.
The odd thing is that even if the "Name:" is subsequently edited to remove the extra lines, the "authentication dialogue" seems to continue to ask for authentication using the "old" name... it's probably being cached somewhere but I haven't been able to track it down.
So in this case, I would call this "user error" for putting "secure" info in an "insecure" field in the first place, but there is definitely some sort of bug / oversight / slopiness in that the authentication dialogue doesn't update - so in effect it is asking you to authenticate for one thing, when in reality it is authenticating something that might have a completely different name. That sort of thing might open up "spoofing" opportunities, but for a user's personal keychain, I would suspect that anyone that can get close enough to do something with it would have opportunities to do far worse. Still, it can't be a good thing...

Using "Keychain Access" as a Password Manager

Similar Messages

Maybe you are looking for